New opportunity

Founding Machine Learning Engineer

Adaptive Security · New York, United States

About this role

Adaptive Security seeks its second ML engineer to establish its machine learning capabilities in New York City. Its products use LLMs and other ML models to detect, classify and respond to cybersecurity threats in real time, including deepfakes, smishing and AI-powered voice scams. The work involves evolving adversarial attacks, limited labeled data for new threats, production-scale systems and strict latency constraints. This is an on-site, full-time role with substantial ownership of an ML function that does not yet have dedicated infrastructure or a team.

Responsibilities

Define where ML belongs in the products, the infrastructure required and build-versus-buy decisions.
Build production ML systems end to end, including data pipelines, training, evaluation frameworks and inference serving.
Establish measures of model quality, detect regressions and use evaluation results to guide model changes.
Develop data acquisition, labeling and feedback-loop strategies to improve models over time.
Write production code within the existing codebase, work with product engineers to integrate ML into the product, and build and lead the ML team as its scope grows.

Qualifications

At least 4 years building ML systems in production; strong software engineering fundamentals and the ability to write production-quality code in modern languages such as Python, Java and TypeScript within large codebases.
Experience with cloud ML infrastructure such as AWS SageMaker, Bedrock, Modal or Baseten, and with ML and data-processing frameworks such as PyTorch, TensorFlow and Spark.
Ability to work across infrastructure, backend services and data systems, independently set direction and drive execution. Experience establishing an ML function at an early-stage startup or serving as a senior or lead ML practitioner elsewhere is ideal.

Compensation and benefits: Competitive cash compensation and meaningful stock; several medical plans, most covered at 100%; a 401(k); unlimited PTO including a Dec 24–Jan 1 winter break; daily free lunch options; and specified late-office dinner and Uber expenses. No salary amount is stated.

For full details about this role, click “Apply on company site” to view the employer’s original posting.

Skills for this role

Machine LearningLarge Language ModelsPythonJavaTypeScriptAWS SageMakerAmazon BedrockModalBasetenPyTorchTensorFlowApache SparkData PipelinesModel TrainingModel EvaluationInference ServingData LabelingCloud ML InfrastructureSoftware Engineering

Checking your profile…

Preparation suggestions, not the employer’s actual interview questions. Always check the original posting for current requirements.

Understand the role

What matters most

Set the ML direction
The role defines where ML belongs across Adaptive Security’s products, what infrastructure to establish, and when to build versus buy. Prepare to explain how you would make and revisit those decisions.
Build production systems end to end
The posting assigns ownership of data pipelines, training, evaluation frameworks, and inference serving. Prepare a concrete account of how you would connect these components into a reliable production system.
Make model quality measurable
The role must define quality measures, catch regressions, and use evaluation results to guide model changes. Prepare to discuss how evaluation would inform release decisions for threat detection, classification, and response.
Improve the data over time
The role owns data acquisition, labeling choices, and feedback loops, while the posting notes scarce labels for novel attacks. Prepare to explain how you would prioritize useful labels and turn product feedback into model improvements.
Ship within the product and grow the function
The engineer will write code in the existing codebase, partner with product engineers, and build and lead an ML team as scope grows. Prepare examples of hands-on integration and technical direction, keeping future team growth distinct from the immediate work.

Likely challenges to think through

Adapting to evolving attacks
A likely difficulty is that attackers change tactics while labeled examples of new threats remain scarce. As a preparation hypothesis, consider how you would detect a shift in model performance and decide what new data to collect before retraining.
Balancing detection quality and latency
The products operate in real time at production scale under strict latency constraints. Prepare to reason through when a more capable model is worth its serving cost, and how you would measure the quality–latency trade-off; the posting gives no specific targets.
Building foundations while delivering features
The posting says there is no dedicated ML infrastructure or team today, yet the role includes hands-on product integration. A likely trade-off is how much platform to establish before shipping useful ML. Prepare a phased approach that makes early work reusable without assuming an existing ML platform.

Practice your answers

Technical practice

How would you decide where ML belongs in a cybersecurity product?

What to coverThe role includes deciding where ML should be applied and making build-versus-buy decisions. Suggested preparation: compare ML with simpler approaches using expected detection value, data availability, latency, maintenance burden, and the cost of errors.

What ML infrastructure would you establish first?

What to coverThe posting says the role will stand up dedicated ML infrastructure from the ground up. Suggested preparation: describe a small initial foundation for training, evaluation, and serving, and explain how you would choose among cloud services as needs become clearer.

How would you design an end-to-end production ML workflow?

What to coverThe stated scope spans data pipelines, model training, evaluation frameworks, and inference serving. Suggested preparation: trace how data and model versions move through those stages, including checks that make results reproducible and failures diagnosable.

How would you acquire and label data for a newly emerging threat?

What to coverThe posting highlights scarce labeled data for novel attack vectors and makes data acquisition and labeling part of the role. Suggested preparation: discuss what to label first, how to check label quality, and how product feedback could improve the dataset over time.

How would you measure threat-detection model quality?

What to coverThe role calls for defining model-quality measures for detection and classification. Suggested preparation: explain how you would assess missed threats, false alarms, and performance on new attack types, rather than relying on one aggregate score.

How would you detect a model regression and decide whether to release a change?

What to coverThe posting explicitly calls for catching regressions and using evaluation results to guide model changes. Suggested preparation: describe representative test sets, comparisons with the current model, and decision thresholds that account for operational trade-offs.

How would you evaluate a detector against evolving adversarial attacks?

What to coverThe role describes attackers adapting to evade detection. Suggested preparation: discuss how to refresh challenging evaluation examples, distinguish genuine improvement from overfitting to known attacks, and investigate newly observed failures.

How would you serve models under strict real-time latency constraints?

What to coverThe products detect, classify, and respond to threats in real time at production scale. Suggested preparation: explain how you would measure end-to-end latency and trade model complexity against throughput, reliability, and detection quality.

When would you use an LLM rather than another ML model for a threat workflow?

What to coverThe posting says the products use both LLMs and other ML models for threat detection, classification, and response. Suggested preparation: compare their suitability for a defined task, including evaluation difficulty, latency, and the consequences of incorrect outputs.

How would you integrate an ML service into an existing product codebase?

What to coverThe role involves writing production code and partnering with product engineers across backend services, infrastructure, and data systems. Suggested preparation: explain interface design, testing, failure handling, and how you would keep integration maintainable across the existing codebase.

Behavioural practice

Tell me about a time you set technical direction with limited structure.

What to coverThe role expects high autonomy while building an ML function without dedicated infrastructure or a team. Suggested preparation: use a real situation, the decisions and hands-on actions you took, and the observable result; distinguish what you decided independently from what you aligned with others.

Describe a time you partnered with product engineers to ship ML work.

What to coverThe posting emphasizes integrating ML into the product and working within an existing codebase. Suggested preparation: give a situation, your specific collaboration and engineering actions, and the result, including how you resolved a competing product or technical constraint.

Tell me about a time scarce or unreliable data changed your ML plan.

What to coverLimited labels for novel threats are a stated challenge. Suggested preparation: describe the situation, how you assessed and addressed the data gap, and what the resulting evaluation or product outcome showed.

Describe a production model problem you investigated.

What to coverThe role combines production-scale ML with responsibility for detecting regressions. Suggested preparation: recount the situation, your diagnostic and corrective actions, and the result, making clear what evidence identified the problem.

Tell me about a time you helped others take on more ML ownership.

What to coverThe role includes building and leading an ML team as its scope grows. Suggested preparation: choose a real situation, explain how you shared direction or delegated responsibility, and describe the result without implying you have held a particular title.

Sharpen your knowledge

Topics to prepare

ML strategy and build-versus-buy
The role defines where ML belongs in the products and what infrastructure to build. Revision exercise: compare a model-based approach with a non-ML approach for classifying a smishing threat, then explain what evidence would support building or buying the ML capability. The comparison is a preparation suggestion, not a stated company decision.
Adversarial threats and scarce labels
The posting describes evolving attacks and limited labeled data for novel threats. Revision exercise: explain how an attacker might evade a classifier and how you would investigate performance on a newly emerging threat without assuming a large labeled dataset.
Model quality and regression methodology
The role must define quality measures, catch regressions and use evaluations to guide changes. Revision exercise: propose evaluation slices for deepfakes, smishing and AI-powered voice scams, then explain how you would decide whether a model change should proceed. The specific slices and decision rule are preparation suggestions.
Data acquisition and feedback loops
The posting assigns ownership of what data to obtain, how to label it and how feedback improves models. Revision exercise: sketch a labeling plan for a novel attack type, including how you would check label quality and turn product feedback into a subsequent evaluation.
Production-scale, low-latency ML architecture
Models must operate in real time at production scale under strict latency constraints. Revision exercise: trace a threat-detection request through inference serving and identify where latency, reliability and model quality could conflict. Those trade-offs are suggested discussion points, not specified thresholds.

Skills to revise

Build a training data pipeline
The role builds data pipelines and model training systems; Spark, PyTorch and TensorFlow are named frameworks. Practice suggestion: use synthetic labeled threat records to outline a Spark data transformation and a small PyTorch or TensorFlow training run, with checks that training and evaluation data stay separate.
Implement an evaluation and regression check
Evaluation frameworks and regression detection are explicit responsibilities. Practice suggestion: write a small script that scores a fixed labeled set, reports results by threat type and flags a decline against a saved baseline. The particular metrics and thresholds are yours to justify, not employer-specified.
Plan and test inference serving
Inference serving and cloud ML infrastructure are explicit; the posting names AWS SageMaker, Bedrock, Modal and Baseten as examples. Practice suggestion: choose one named option, diagram a hypothetical inference path and test how response time changes with request volume. No specific platform is mandated.
Integrate ML into production code
The role requires production-quality code in an existing codebase and collaboration with product engineers; Python, Java and TypeScript are named languages. Practice suggestion: write a small backend integration in one of those languages that calls a model interface, handles failures and includes tests for its expected responses.

Your preparation checklist

Prepare an end-to-end production ML walkthrough
Select a real project, if available, and outline your decisions across data pipelines, training, evaluation, inference serving and operations. Bring concrete evidence of your contribution and results; these are all parts of the advertised role.
Sketch a real-time threat-detection design
As a practice exercise, diagram how an LLM or other model might detect and classify a deepfake, smishing attempt or voice scam. Explain latency and scale trade-offs without assuming Adaptive’s current architecture.
Draft an evaluation and regression plan
Prepare a sample scorecard for model quality, evolving adversarial attacks and changes to the threat mix. Show how you would use results to catch regressions and decide whether to change a model.
Outline a data and feedback strategy
Write a brief proposal for acquiring and labeling examples of novel threats, then incorporating product feedback. Identify what you would need to learn before choosing a labeling approach.
Map your engineering and technical-direction evidence
Gather specific examples, where available, of production code in a large codebase, work across infrastructure, backend and data systems, cloud ML infrastructure, and collaboration with product engineers. Separately prepare a build-versus-buy rationale and first priorities for a function without dedicated ML infrastructure.
Prepare questions about scope and constraints
Ask which product decisions most need ML, what latency and evaluation constraints apply today, what data and feedback are available, and how the second ML engineer would partner with product engineers and help grow the function.

Availability last checked: Nov 4, 2026. Status can change after a check; confirm on the employer’s website. Report an issue · Our checking policy

KEEP EXPLORING

Similar AI jobs

Related skills and specializations in United States. Matched to this role, not your profile.

Explore more jobs

Finding similar opportunities…